From 9a72d24693f515598898635c739b8ce55ec04e69 Mon Sep 17 00:00:00 2001 From: "Ilya V. Matveychikov" Date: Mon, 2 Jul 2018 23:52:43 +0400 Subject: [PATCH] Update reptile.md --- details/reptile.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/details/reptile.md b/details/reptile.md index c5f64a1..4594df1 100644 --- a/details/reptile.md +++ b/details/reptile.md @@ -32,7 +32,7 @@ Rootkit is trying to evade from detection by: ## Management interface -Implemented via `kill(2)` by hooking `sys_call_table[__NR_kill]` entry: +Implemented via `kill(2)` by hooking `sys_call_table[__NR_kill]`: - https://github.com/linux-rootkits/Reptile/blob/master/rep_mod.c#L509 Supported commands are: @@ -58,6 +58,7 @@ Hooking of system calls by patching syscall-handlers in `sys_call_table[]`: Filtering of file content while reading: - hook `sys_call_table[__NR_read]` + - https://github.com/linux-rootkits/Reptile/blob/master/rep_mod.c#L282 - https://github.com/linux-rootkits/Reptile/blob/master/rep_mod.c#L638 ## Hiding of files and directories